d4ee121a5b68e7d9762081de2fe36750a9079072005c2b4043451b4064930d61

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4586bd957eae62c593275209064db1a0_JaffaCakes118.html
Size

9KB
MD5

4586bd957eae62c593275209064db1a0
SHA1

cdd6e4ab49bc90c33d9f81b940f044f493284bd0
SHA256

d4ee121a5b68e7d9762081de2fe36750a9079072005c2b4043451b4064930d61
SHA512

cd13bdf34261f69a3684e14cae7644e85e078f576e7db86bd294ac1806a7e301a950c049558a13f4518f75d6ed28bf9b3549bfdb587a0d43fdf9ebcede8582d6
SSDEEP

192:Ig12cR4/Euq7EKQ213mAsvNrIdcG54w3vkiUM5/CD:Ig1DwEucQklPag9w

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421927135"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60BBCAA1-129D-11EF-84CA-6E6327E9C5D7} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
640	iexplore.exe
640	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 2860	640	iexplore.exe	28
PID 640 wrote to memory of 2860	640	iexplore.exe	28
PID 640 wrote to memory of 2860	640	iexplore.exe	28
PID 640 wrote to memory of 2860	640	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4586bd957eae62c593275209064db1a0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:640 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
311d69c7d6f9c4dfcb2bbeba5e39886d

SHA1
14031a6ebea7f1741eb4c574c4b29b33a81075e5

SHA256
c151050de1cbc271822c7d10ee8376936517fc684272db587849c08360c09316

SHA512
def664322246c597cd318d7598df42b2e1aac226f3b2beac9bb78edd9d8fcc7285035d5704ce348844e26afff931f9b4ea523548503dfdec90b9f12b150e5e8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
991813642d4534dfe51f97289277ecc6

SHA1
dfad4e288b30289ecca77a2de21d25414a566ae7

SHA256
d7ace1ff409298a323ac6e4ae285ba1bbdb3b12a87a7f0b3f3391caabe789413

SHA512
18d2ed2fc80452de7508dd13b381ce4e275dabf18c08d9d277dfad5154d44cfdf746327e30d25fdd6420703a137395110ab3b9d9d0876fcb777a76af754d7aac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42e1419554867c41c5271710488f2c27

SHA1
bca281633eaad46fa17a21bfa8ca7265229defc7

SHA256
55e541ec64ad9718c162cd10da3fd823ef51f71bee451b15175d5a5356f8f286

SHA512
a2dc6dce2ae7605448b5dd88359066359a29c80a07b037a1c4df7cfa34a6b73316f53a607514432fb2472517b0a30c6bffced24a424394242c01aa73cb23c0ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cbc78c7b15084fe99e03fdbd4692d1c3

SHA1
27dff27b6c7e483095d3fd1189512be1b8afcdbf

SHA256
ac9cccb40e04be6375fcac6151eba651d6d162d4c4369c91488412fe46ebab3a

SHA512
59a0cfb14eedfa5cc9fad8d70223ab592614a99549be40a54c4ddc8f525a9e3caa4f6ce90e6f08e115409988705907a21a5c175045c61fa69e9db8ed5764013e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a05fa5bccc2f03d50ecfd1b90b52cbb

SHA1
adccc16048ea6104b2eb30ba5bc2fd50af951ac3

SHA256
e6818f68f941512ae47015b71eaba7b74329b67bb43e9fae2c71b56b7a851946

SHA512
8bbfcbcca716531bf54a890aaec036ce947a7c47028da372eae8e9217508a6bf8f9f3afe2c118f7ab47aaaca2e5cd5e270744f7c4eeaf8b44c24f5b204257208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9fa1c1e36f2c90f7ca7ddf56c08f3332

SHA1
54b80b0c4b5c7d16f6dcee5e86560c1a064af838

SHA256
31d4778ba8577ac74e0db2f2654daf99298224a0afa6e23dcb2599643f2cf00c

SHA512
5e08321d9ef4c52cdd59ca24e49d01f07772cf5244f8ee2f455f77fd6e617dc11b46dc57fa9c7c9a64639012298bfeb6f2b25aa95f0e1e4540a4a75e32fe030b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ec1c6db9975e98ea8640f74d28bbf8cc

SHA1
6844d44af6cf0f6776d0465816896769432e7c65

SHA256
e2fd4d61c8c3c383932d8454d576e5038f812c23e3deb11bcae682a266925433

SHA512
193117e998d1ba0f7560df11e867319d099cddf1e353883209ae4f4e23028d9313af7efb38dca193abb96fde066a5a3bb07a868571e703d525fb8c33af52fafc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40f508f26abfc766d8b9aa277c7aa471

SHA1
13eeeb3f986b11c7518a7d2061ee6178e2026eb4

SHA256
2a5974b63906af35108a1cc6bbc8451b2d48e6a0c6fbca94d8d702ba8f7b61f7

SHA512
803bdfd3507dab602fa3d6896a7b3e131ccdc730f51bd4917409b439f831a0dc6f5380dac1183fb9f793a84d375170a800a659121da8d749205ed5b24c69321b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4f75dab984481fc3e3b0c1f887b80b9

SHA1
e81686146a650a3a920c44a0cad3f612e65699ee

SHA256
61ea150346b0ae8556339f611efd7e02e182ca8860ecacc96df61a785e41ac20

SHA512
fd0e275d5941f763e92f91ca6fda2ea472d23feeba9d97327f861356f7231ef9f40904a4ad7e8828ffef60c6766ea1214dfd804a8a556349cabf0c3dccb5e517

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06cec18c0a338543ff6d41df90a38328

SHA1
475a087b0a613cdca86cac5b7e438687ae90a966

SHA256
cc82201eed3a6d9c15cdba9ecc6f3fa8fb18cfdcdd51d58be678f612a89290c9

SHA512
3ed5e3562eda2f4bb0f376fb5dd76768b6c293fbe668707d74cb986497e0a49d16b684e215b43a66e68fa726c880ef2698821cd6995427e05b8364a5f51d2da9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
162d0fc997ed66ea39c99451b41360a4

SHA1
f75736180f922a76aae865e7355a9a578e792b9a

SHA256
6b28c9f5f9d7a1d34e6053c3263990c20120c4b9c2dc3030ea31e42bc33f00a4

SHA512
0aedf7652eb4fa506912064677b84507b3fd7b94aabc36647b1107f59c0bed1fa4fcb2eaf0ee8b999b4fce91b49002035e5af42f0b3f4374ec6f6313d0bdf255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0860a6298466c10047bbccab438fd1c7

SHA1
dafcbc976ab2e86567e5d9a07f113e0f358654dd

SHA256
ccf53fd92a81c4d97378f525ae45f41dd158c8aeb591ccd0144e634c551292e7

SHA512
b4adac33729480fb021b55c6fb50e4c2e4b42f6d6c4583b48cbf09d1abe17d08984ebd5b46e239c8ddf0c13b535469e5e162e24b196fc40497f162ecd0a58289

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
731d8db1995f5db57719a7b6aab4d2f0

SHA1
9d1c27bda1f09d23c1b1e5f1897eb61854863fe7

SHA256
7a3152a0dcd0701f3f7303c4925ee94970833739c17d8c46849e13345278fed8

SHA512
69dacfe8293b97bca0b74a62c7b771b665da982697f425fcf69e2f6d86a1d587d5358999bfb1df0955ae5788fddbb963d49d2ac653fd88bc55d8aed8002fc4e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
051048592fd8a08f2bf8985e3c0c8cae

SHA1
279f187118f2b76e339c17365d27e562e14a3acb

SHA256
b367163b9ca19365a9361e83bfcf52455046a0ae28b3226337a9731c3c571f2e

SHA512
4798eadc0ebd3107d0801975dce6901c1462f42f5d1f64ba248d506a5dbdedd543ca0fbbaf4dcf16058b016a8bf0753dba030042736de28fa783581454dc425f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df51d05df83ecbc08913267664aa04fd

SHA1
dec7bce5c0d5ad9ac347fb925c6fd7c5c4eafc2b

SHA256
9d5b849c76ea35d6d58e3f57a21d8cb1406b1f76fe9f4289986dd4fe380ce240

SHA512
baaa4d433e538cd2073d9139a38db026cd714d64084129cdaf8870d7b2d6500926ab3da22b112284c34401983a0ca2f4bb942a03111d12282d855cbb53dd9e0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb63c8eaa932e599c0c6c41c7e9dc737

SHA1
8c5aa6d57a97fcd6b08e1b7a4169f54c097d9aa2

SHA256
501697044894fe65210d2736086a8b46d52c6155016e046fa71631e2e8620df3

SHA512
6d5068847789c2a47e1e3ea5585dcb7c131bb4807d8f5a5deb22678e948dcffce92ba628bb24126f3c746b86d529750da2f22b154981f8dbc81efc4bf66c51f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6dcc16014b9a041e4cfa53eb1190af6f

SHA1
054bd3d023dc771e7270edde1c8dc95eb0b854d3

SHA256
922a52f8629cb563260005998675450e3f275efc2ea31f97031a78f124d539d4

SHA512
4f44b60fa7309cde3646095a2179cc23f417b9b9bf488fc0a25cf90179d34f3c9ac0a5c6c2a9baac56c36e8077807b66d91903e5d80fc2fb0bd8f35571084877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28afe0a386fa9fed3f91e3358b203f74

SHA1
395fbfcc3a54e8205d123295b2742796ab88882b

SHA256
67de227dc5a4bd6e6c8a00082173cc2f1980dce4448b45fece961995d619a9ce

SHA512
20c233c605b5afd938643abf487acbda508fc84e56a277a02301e67ba588ead1408343a6bb91978fc4410c05bee74b26f7c8a4e9b09014b6f0be218ce821ace5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9A3D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9C0A.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit